ISCD Publishes CFATS Fact Sheet – October 2017

Today the DHS Infrastructure Security Compliance Division (ISCD) published their latest version of the Chemical Facility Anti-Terrorism Standards (CFATS) Fact Sheet. The data continues to show a net increase in the number of facilities covered under the program and a similar increase in the number of compliance inspections completed to date. The data still paints a confusing picture that would seem to indicate a high rate on CFATS non-compliance.

The Data

Table 1 shows the comparison between the data reported today and that reported last month for facilities currently covered by the CFATS program. For the first time since reporting resumed we see a positive month-to-month change in all of the reported categories

Current Facilities	Sept 2017	Oct 2017	∆
Covered Facilities	3,441	3,492	+51
Authorization Inspections	2,354	2,374	+20
Approved Security Plans	2,266	2,270	+4
Compliance Inspections	2,071	2,106	+35

Table 1: Current Facility Data

Table 2 shows the similar comparison of monthly data for the total numbers for each category since the inception of the CFATS program. As expected the month-to-month change in each category is positive, but we continue to see a significant disparity between the two tables in differences (∆) for compliance inspections and both authorization inspections and approved security plans.

Total Facilities	Sept 2017	Oct 2017	∆
Authorization Inspections	2,946	2975	+29
Approved Security Plans	2,756	2766	+10
Compliance Inspections	2644	2807	+163

Table 2: Total Facility Data

Compliance Inspections

If I update the graph that I used last month to include the current data (Graph 1) we can see the sharp differences between the rate of change in current approved site security plans (a pre-requisite for having a compliance inspection), the total number of compliance inspections completed to date, and the current compliance inspection numbers.

Graph 2: Compliance Inspection Data

As with last month, it is hard to come up with any explanation of the data presented by ISCD other than to conclude that ISCD is finding a disturbing number of facilities non-compliant with the implementation of their site security plans. What makes this so disturbing is that facilities negotiated with ISCD on setting the content of their site security plans, so it is hard to believe that they were ‘not aware of program requirements’.

Security of Non-Compliant Facilities

The big question that this raises is how secure are these non-compliant facilities? That is a question that is next to impossible to answer from the data that ICSD is allowed to share with the public. ISCD is not about to, nor can they legally, share any data about the security of covered facilities.

Of course, I am under no restrictions about the conjectures that I raise in attempting to answer this question. So here goes an uninformed, but educated guess as to what is going on…

First, I think that basic security measures are in place to deter, detect and delay terrorists desiring to attack these facilities. Those are all fairly straightforward and would have been in place before ISCD authorized or approved the site security plans (SSP) under which these facilities operate. I suspect that the non-compliances fall into three categories:

• Planned security measure failures;

• Changes is security posture; and

• Cybersecurity

Planned Security Measures

The first category covers those high-expense capital expenditures that facilities could not immediately implement because of budgeting constraints. ISCD gave facilities credit for these security measures when approving the SSP, because specific plans and budgeting approvals were in place. As with any plan, things can go wrong and those plans may not have been at an appropriate level of completion when the Chemical Security Inspectors (CSI) showed up for the compliance inspection will be a problem. Those would certainly make the facility non-compliant.

How badly that would affect the actual security of the facility is hard to tell without knowing the details. ISCD would have required some sort of interim compensatory controls to be in place to mitigate the vulnerabilities while the planned action is implemented. So, while there may be a hole in the security plan, it should not be gaping nor readily identifiable.

I do know that ISCD has no quota of non-compliances to issue and would I would bet that, if facilities in this situation had previously talked with ISCD about the problem they were having with their planned security measures, they would have been able (in most reasonable cases) negotiate a new time frame for implementation. When the inspector gets there, it is certainly too late.

Material Modifications

I suspect that the second category is probably the most common reason for non-compliance. The CFATS program requires {6 CFR 27.210(d)} facilities to submit a new Top Screen whenever it “makes material modifications to its operations or site”. This allows ISCD to determine if a new or revised security plan is required to mitigate any security vulnerabilities associated with those changes. Since ‘material modifications’ is not a defined term in 6 CFR 27, it would not be surprising to hear that facility or operational changes that the facility made without an apparent security purpose might be considered a ‘material modification’ in light of the undisclosed risk assessment process that ISCD uses to evaluate facilities for program coverage and risk tiering.

CFATS covered facilities need to take a hard look at any facility, chemical process, or business procedures changes with a specific eye to its potential effect on the efficacy of the site security plan. This especially applies to any procedure or device specifically mentioned in the SSP. This is one of the reasons why it is important to have a site security manager who is an integral member of the facility management team.

Cybersecurity

The final category is more of a stretch of my intuition, but with an increasing focus across DHS on cybersecurity issues, it would not be hard to guess that implementing Risk Based Performance Standard (RBPS) 8, Cybersecurity, would be an item on specific interest on compliance inspections. Facilities with access to a well-trained cybersecurity team, would probably have no problems implementing the agreed upon cybersecurity measures in the SSP. Facilities without such support would have a much more difficult time in meeting the cybersecurity requirements of a reasonable cybersecurity plan.

This is the one area that I am not as confident in the overall security posture of non-compliant facilities. Again, it would depend in large part about the chemicals of interest involved and how much control systems and inventory controls played in the security of those COI at the site. But, there are so many ways that either informational or operational computer systems could impact security plans that I suspect that this is the area with the widest variation in actual the security of dangerous chemicals across the country. Which would be why ISCD would be specifically focusing on the security of these systems in any compliance inspection.

Moving Forward

We are a little more than a year away from the current expiration of the CFATS program (12-18-18). Congress is likely to start looking at this program again as they consider reauthorizing the program. If ISCD is having the high non-conformance rate that I think the current data indicates, there will certainly be questions asked on the Hill about this topic. I hope ISCD has some good answers.

DHS Publishes New CFATS Fact Sheet

Today without any specific notice the DHS Infrastructure Security Compliance Division (ISCD) published a link on the CFATS Knowledge Center for a new Chemical Facility Anti-Terrorism Standards (CFATS) Fact Sheet ‘Documentation’ section. This is not the latest version of the statistics on the implementation of the CFATS program (each also called ‘CFATS Fact Sheet’ by the way) that I routinely report on. Rather, it looks like a replacement for the 2012 ‘CFATS Trifold Brochure’. The link to that brochure is still active as of 22:30 EDT. The tri-fold brochure link has been removed from the ‘Documentation’ section of the CFATS Knowledge Center.

The CFATS Fact Sheet has also been printed as an article in the frequently asked questions section of the CFATS Knowledge Center. It can be found as Article 1775.

Nothing really new here. The new documents briefly describe the CFATS program. There is a brief new mention of the 2014 CFATS authorization legislation, but no discussion of the changes brought about by the law. Neither is there any mention of the on-going CSAT 2.0 implementation process.

CFATS Fact Sheet Published – 11-4-15

Today the DHS Infrastructure Security Compliance Division (ISCD) published their latest CFATS Fact Sheet containing information on the status of site security plan (SSP) implementations for the Chemical Facility Anti-Terrorism Standards (CFATS) program. They continue to show steady increases in the number of authorized and approved SSPs and a similarly increasing number of post-approval compliance inspections.

The table below summarizes the numbers from this report and the previous report.

	October 2015	November 2015
Covered Facilities	3,160	3,146
Authorized SSPs	3,213	3,242
Approved SSPs	2,208	2,256
Compliance Inspections	211	295

We continue to see a slow but steady decline in the number of facilities that are leaving the CFATS program. ISCD has not yet provided any detailed information on the reasons for the decline in covered facilities. Various potential reasons (in no particular order) include facilities going out of business, facilities reducing the level of inventory of chemicals of interest (COI) below the screening thresholds, and facilities replacing COI with presumably less hazardous chemicals. The later would be the most preferable from the aspect of program goals.

We still have the interesting data anomaly that I noticed last month where there are more authorized SSPs than there are facilities in the program. Apparently ISCD is just keeping a simple tally mark each time they authorize an SSP. Since I know that there are at least two facilities that are in the process of submitting their SSP, it is obvious that not all covered facilities have an authorized SSP at this point in time (and I would be disappointed in the chemical industry if that point were ever reached). So we either have facilities with multiple authorized SSPs (unlikely but possible) or a number of the facilities with authorized SSPs have left the program. This then raises the question, has the cost of security put some of these facilities out of business?

While it is still early in the expedited approval process (EAP) I am disappointed in the lack of a surge in SSP approvals. We should certainly be seeing by now the approval of the initial batch of EAP submissions. The lack of that surge indicates that either this congressionally mandated program is less popular than expected, or that the ISCD implementation is more complex than Congress expected. The Fact Sheet data will never provide the information necessary to determine which the predominant cause is, but it does bear watching this space for future developments.

This is the second month that ISCD has provided compliance inspection data, so it is difficult to effectively comment on the significance of 84 new compliance inspections being completed in the last month. The data does, however, remain incomplete in that ISCD has provided no information on the pass/fail rates for those inspections. We know from an earlier GAO report that there was a fairly low pass rate (a little more than 50%) on the initial 83 compliance inspections. The lack of result data in this fact sheet raises the inevitable questions about the ability of chemical facilities to comply with their site security plans.

I would like to make a new suggestion for data that could be included in this monthly update; the number of active Chemical Security Inspectors supporting the program. We know that the program has had problems in the past meeting their manning projections and the appropriations folks have been taking them to task for this in recent appropriations bill reports. A simple reporting of the number of authorized and filled slots would be valuable.

I haven’t mentioned this in a while, but for all my nit-picking complaints about the information in these reports, I have to note that ISCD voluntarily started providing this monthly update on their process and making it publicly available on their web site. Other regulatory agencies should take note and make similar efforts.

CFATS Fact Sheet – October 2015

I have been kind of surprised that the DHS Infrastructure Security Compliance Division (ISCD) has not yet published their CFATS Fact Sheet for October. I had a little time on my hands earlier today, so I went searching and I found it. I’m not sure if ISCD had intended on releasing this yet, so take all of the comments that follow with a grain of salt.

The table below compares the data from the October Fact Sheet with the September Fact Sheet that I discussed last month.

	Sept 2015	Oct 2015
Covered Facilities	3,197	3,160
Authorized SSP	3,178	3,213
Approved SSP	2,104	2,208
Compliance  Inspection		211

The month-to-month trends for the two SSP categories look good; they continue to show improvement. And ISCD has finally started to list the number of compliance inspections that it has completed. As expected we have a long way to go to get all of the compliance inspections done, but at least we can now see how much progress is being made.

It is interesting to see that the number of covered facilities continues to drop. Unfortunately, that is still a data point that can be interpreted in a number of different ways because of the lack of substance in the information provided. It could be a good thing if facilities are finding substitute chemicals that do not present the same terrorist target risk as the DHS chemicals of interest that are being replaced. Or it could be a sign of impending doom as more and more chemical facilities go out of business due to the cost of implementing CFATS site security plans. Or it could be a sign of increasing risk as facility managers find creative ways to reduce on site inventory of COI by keeping them in transit for longer periods of time (stored at freight warehouses or train yards).

The neatest statistical anomaly is that the October Fact Sheet now reports that there are more authorized site security plans than there are covered facilities. Actually, this may be the reason that the Fact Sheet has not been publicly released yet; at the last minute someone realized that that anomaly would make the Department look a little silly.

What I suspect happened is that someone is keeping three (now four) separate spread sheets to keep track of these statistics. When a facility is removed from CFATS coverage, its name is taken off of the spread sheet of covered facilities. Apparently, however, that same facility is not being taken off of the other three lists of authorized, approved and inspected facilities.

In one way that makes sense since the Department already did the work on authorizing the facility site security plan so they should get credit for that work. On the other hand, if this is the reason for the data anomaly then we cannot really tell from the data in the Fact Sheet how many facilities have yet to have their SSP authorized.

Another potential explanation is that a facility could have completed the SSP submission process and had the SSP authorized and then had to submit a new Top Screen that required a substantial rework of the SSP which got counted as a new authorization when it reached that stage of the process. If that is the case it is an even more confusing data point.

This is one of the problems that one runs into when numbers are reported without explanation. ISCD started this voluntary data reporting out of self-defense a couple of years back. And they took the easy way out by just simply publishing numbers without explanations, probably because they really did not have a spare person to keep up with this type of reporting. ISCD has been having the same type of hiring and retention problem that we have been seeing across the entire Department. And, there personnel authorization has never really been that high considering the number of facilities covered and the detail of inspection that ISCD has been attempting to accomplish.

It will be interesting to see if this version of the October Fact Sheet ever gets officially published.

NOTE: The link to this Fact Sheet was published today on the CFATS web site. No explanation was provided for the data discrepancy. {Added 9:20 pm CDT; 10-8-15}

ISCD Publishes September CFATS Fact Sheet

This morning the DHS Infrastructure Security Compliance Division (the folks that run the CFATS program) published their September CFATS Fact Sheet, providing updated information on the progress being made on the completion of the Site Security Plan (SSP) approval process.

The table below summarizes the important numbers included in the new Fact Sheet and compares it to the August and July Fact Sheet numbers (NOTE the August link is to my blog post because the August Fact Sheet is no longer available on the ISCD web site. Both the July and June Fact Sheets are):

	July	August	September
Covered Facilities	3,229	3,223	3,197
Authorized SSP	3,121	3,139	3,178
Approved SSP	1,935	2,021	2,104

The relatively small increase in approved SSPs would seem to indicate that we are not yet seeing the effect of facilities submitting SSPs under the Expedited Approval Process. Since the first EAP SSP could only have been submitted on July 16^th we are still well within the potential 100 day limit for DHS to disapprove an EAP submitted on that date. I expect that we will start to see an increase in numbers when the October Fact Sheet is published next month, but we won’t see the gross effects until November or December. The EAP approval process for facilities already in the CFATS program as of June 16^th will not be completed until near the end of February.

The other impressive statistic in the new Fact Sheet is that we are now at about 99% on the facilities that have an authorized Site Security Plan. This is the first stage of the SSP review process and reaching that 99% point means that we are essentially at full compliance on submitting SSPs. The program will probably never reach the 100% authorization rate as new chemical facilities are being built and added to the program fairly frequently. There is a time lag between the time that a facility is notified that it is a covered facility and the time that it is required to submit an SSP.

Which, of course, leads us to one of my pet peeves; we see another unexplained drop in the number of facilities covered by the CFATS program. There are a number of legitimate reasons that a facility could be removed from the program; they could have eliminated or reduced the use/storage/manufacture of the DHS chemicals of interest (COI) that form the basis for entry into the process; or the facility could have been closed. I actually know of a covered facility that burnt to the ground (certainly no remaining security issues at that site). What bothers me is that DHS has refused to publish numbers reflecting the reasons that facilities have left the program.

The reason that I harp on this so much is that we need the numbers to intelligently discuss how ISCD is handling the verification of the changes. Without understanding why the facilities are leaving the program we can’t even ask legitimate questions about the process.

Finally, there is one other area where DHS is not sharing information about the CFATS process. We know that they started doing compliance inspections well over a year ago. We know from the latest GAO report on the CFATS program that ISCD had completed 83 such compliance inspections early this year. What we don’t know is what they have done since then. Given the problems that the GAO identified in the compliance inspection process we can be sure that Congress is going to start asking questions about this area. I don’t understand why ISCD hasn’t gotten in front of this problem by starting to publish the numbers.

ISCD Publishes August CFATS Fact Sheet for August 2015

This afternoon the DHS Infrastructure Security Compliance Division (ISCD) published the August 2015 Chemical Facility Anti-Terrorism Standards (CFATS) Fact Sheet. There was little change in the number of authorized Site Security Plans (SSPs) and an even smaller change in the number of covered facilities. We do see a significant continued improvement in the number of facilities with approved SSPs.

The table below provides a comparison of the numbers in the July 2015 and August 2015 Fact Sheets.

	August 2015	July 2015
Covered Facilities	3,223	3,229
Authorized SSPs	3,139	3,121
Approved SSPs	2,021	1,935

CFATS Fact Sheet Data

It is too early to see any significant change in the Approved SSP numbers due to the Expedited Approval Program. Facilities were able to start submitting EAP SSPs about half-way through the month, but the folks at ISCD still have to review and approve those submissions. The Department has up to 100 days to complete that review. I suspect that we could start to see some of those approval affecting the September 2015 Fact Sheet numbers.

ISCD is still not reporting the number of compliance inspections conducted or the results of those inspections. According to a recent GAO report (pg 28), as of February of this year there had been 69 compliance inspections completed with only 35 of those facilities having passed the inspection. The GAO reported that ISCD was working with the non-compliant facilities instead of taking any of the authorized enforcement activities available to the Department.

NOTE: There had been a minor coordination issue earlier in the day with the publication of the Fact Sheet. The Critical Infrastructure: Chemical Security web page change which provided the link to the new fact sheet was published before the link became active so the page was for a short time pointing at the July 2015 Fact Sheet.

ISCD Publishes CFATS Update for July 2015

Today the folks at DHS Infrastructure Security Compliance Division (ISCD) published the latest CFATS Fact Sheet. The Fact Sheet provides some numbers associated with the implementation of the Chemical Facility Anti-Terrorism Standards (CFATS) program. The numbers show a continued improvement in the number of site security plans (SSP) that have been authorized and approved. The table below provides a summary of the data from this update and the previous month’s update.

	June 2015	July 2015
Covered Facilities	3,238	3,229
SSP Authorized	3,104	3,121
SSP Approved	1,868	1,935

Actually the July data only reflects one half of a month since the effective date for the June report was June 15^th and the July report is dated July 1^st. However, if we look at the per-day rate change we can see that the authorization rate is much lower than normal (1.4 per day vs about 6.0 per day this year). This almost certainly reflects the fact that the back log of facilities with submitted SSP’s has been practically eliminated. The daily SSP approval rate is just about what we have been seeing this year.

As I noted in an earlier post we are about to see a major change in the way that facility SSPs will be approved for the Tier 3 and Tier 4 facilities that not make up the bulk of the unapproved SSPs. Starting on July 16^th Tier 3 and Tier 4 facilities (whether or not they already have an approved site security plan) may begin to submit EAF SSP documentation. While we are waiting to see exactly how ISCD will be accepting that information (I suspect a new on-line EAF tool in the Chemical Security Assessment Tool – CSAT) I expect that the submission process will sufficiently streamlined that we should be seeing submissions in relatively large numbers early in the process. Within 100 days of a facility submission DHS is required to take action on the submission (approval/disapproval) or they SSPs automatically become approved.

All in all, I think that we are going to see a major change in the SSP implementation reporting next month. Hopefully, that will include reporting on the reasons behind the decline in the number of covered facilities as well as data on the compliance inspections that have been done on facilities with approved SSPs.

CFATS Knowledge Center Update – 06-17-15

The folks at DHS Infrastructure Security Compliance Division (ISCD) added two news notes today to their CFATS Knowledge Center. The first one is about the addition of the email address to the CFATS Tip Line and the second is a link to the latest CFATS Fact Sheet.

CFATS Tip Line

In addition to providing the email address (CFATSTips@hq.dhs.gov) that has been added to the CFATS Tip Line notification methods there is also a link to a two-page flyer about the Tip Line. There is no real new information in the flyer; it is essentially the same as the CFATS Tip Line web page that I reported on yesterday.

I don’t see any requirement to post this flyer, but most federal regulatory programs do expect to see covered facilities to post this type information as a means to communicate the information to employees.

CFATS Fact Sheet

The publication of the CFATS Fact Sheet looks like they may be closing out (my supposition, nothing stated) the current reporting system in the manner I discussed on Sunday. The data cut off is June 15^th instead of the first of the month that we have normally seen. Since the data covers a month and a half, I will not be doing the graphs that I have been doing for the last two+ years. Instead, here is the information that I have been tracking:

∙ Facilities currently covered under CFATS – 3,238 (down 90 from May 1^st)

∙ Facilities with authorized SSP – 3,104 (up 41 from May 1^st)

∙ Facilities with approved SSP – 1,868 (up 86 from May 1^st)

Interestingly, the Fact Sheet also reports that ISCD has now reviewed more than 50,000 preliminary assessments (Top Screens). The last reported figure was ‘more than 49,000’ so they are apparently continuing to see submissions from new facilities.

Also, the May 2016 Fact Sheet is still listed on the CFATS landing page. I expect that that may have simply been an oversight.

NOTE: Still nothing on the EAP notification tool for CSAT. I have an email into ISCD waiting for information.

ISCD Updates CFATS Fact Sheet – 03-04-15

This afternoon the folks at DHS Infrastructure Security Compliance Division (ISCD) published an updated copy of the CFATS Fact Sheet. The Fact Sheet shows the current status of the Site Security Plans in the program. It continues to show an increasing number of facilities with authorized and approved site security plans.

Just as consistently it shows a decreasing number of facilities that are covered by the Chemical Facility Anti-Terrorism Standards (CFATS) program. There are a number of legitimate reasons that a facility could be removed from the program, but ISCD continues its policy of not explicating the reasons for the 700+ facilities that have been removed from the program in the last year.

The third leg of the SSP compliance program, the compliance inspection results, also continues to be ignored in the CFATS Fact Sheet. The compliance inspection program determines if the facility is actually living up to its obligations outlined in the authorized and approve site security plan. This is the only real measure of whether or not a facility is secured against potential terrorist attack.

ISCD Publishes CFATS Update for March 2014

I thought it was an April Fool’s joke last night when I saw a listing for the April 2014 CFATS update on the DHS Critical Infrastructure: Chemical Security web page and it was reinforced by the fact that the link didn’t work. I contacted DHS this morning and it was a glitch not an April Fool’s joke that provided the bad link; the page is good and is now live.

The report shows continued incremental improvement in both the authorization and approval rates.

Table 1 shows the general continued improvement in both sets of numbers.

 Table 1: Total Program Numbers

Table 2 shows the average daily rate of both authorizations and approvals for the month of March. The authorization rate picked back up significantly and is the highest rate seen to date. The approval rate is still good and is the second highest seen to date.

 Table 2: Average Daily Rate

Everyone would like to see a dramatic increase in both rates so that the current backlog could get erased. I don’t think that we will actually see this as there is only so much that can be done by the current sized inspection force. Dramatic improvement will only come about through a significant change in the way that inspections are done and that would require a significant change in the regulations I’m afraid.

NOTE: ISCD continues to report declines in the number of covered facilities. This month it is down to 4,172 from 4,199 last month. Still no explanation of why the number is going down while we are expecting to see an increase due to some of the EO 13650 outreach activities.

CFATS Fact Sheet – February 2014

I just got an email from a contact at DHS that provided me with the link to the February 2014 CFATS Fact Sheet. It is not yet available on either Critical Infrastructure: Chemical Security [NOTE: As of 4:30 pm CST, 2-24-14, it is on this page] web page or on the CFATS Knowledge Center.

The important numbers as of February 1^st (numbers as of January 1^st)

• CFATS Covered Facilities – 4,266 (4,266)

• Security Plans Authorized – 1,389 (986)

• Security Plans Approved – 506 (417)

Table 1 below shows the overall number of authorized and approved Site Security Plans for each month since ISCD began publishing monthly numbers.

 Table 1: Total Authorized and Approved SSPs

Table 2 shows the average daily rate authorizations and approvals for the periods in question.

Table 2: Daily Average Authorized/Approved 

As I mentioned this weekend, I expect that the February numbers will be published early in time for Thursdays House hearing on HR 4007. If the numbers continue to improve like these latest figures show, some of the heat will be off of Director Wulf at that hearing.

ISCD Late Again with CFATS Update

Here we are three-quarters of the way through the month of February and there has still not been a CFATS Fact Sheet update for the site security plan implementation numbers for the month of January (the January CFATS Fact Sheet covers, of course, December). I understand that DHS is in no way obligated to keep the public up-to-date on how well they are overcoming the problems that previously plagued ISCD (just a little touch of sarcasm there, I apologize), but when they started publishing these monthly updates back in April of last year they established an expectation that they would be published in a timely manner.

It will be interesting this week because I expect that we could see two updates published one for the January data and the other for some portion of February. Or, ISCD could just wait until Wednesday to publish the combined data for the two months.

The reason for an early publishing of the February data? I expect that Director Wulf will probably be making a trip to Capitol Hill for a hearing on HR 4007 on Thursday. I’ll have more information on that hearing in my weekly congressional hearing blog post.

ISCD Updates CFATS SSP Status

This afternoon the folks at DHS ISCD got around to posting their year-end update on progress being made on the authorization and approval of the CFATS site security plans with the publication of the January 2014 CFATS Updated Fact Sheet. The data provided is up-to-date as of January 1^st.

Readers will certainly remember that the last published update was data through November 19^th and that reflected some poor performance numbers due to getting the inspection and authorization program back up and running after the federal funding fiasco. This report covers the entire period from November 19^th to January 1^st.  Given the fact that there was still some program recovery taking place and there were three holidays included in the time frame the numbers are not too bad.

Figure 1 shows the total number of SSP’s authorized and approved through the end of December. I am changing my month naming convention to reflect the full month of data presented, starting with December.

Figure 2 shows the average number of SSP’s authorized and approved on a daily basis using 25 working days for the period.

Again, keeping in mind the screwy starting situation and the fact that even discounting for holidays, people are short staffed during the month of December, both in government and industry, we have to give ISCD credit for getting a goodly number of actions completed. Given this pace, I expect to see a greatly increased number at the end of January.

CFATS Fact Sheet – August 2013

The folks at ISCD got the August CFATS Fact Sheet update out real quick, posted this morning with data effective yesterday. I’m sure that part of the reason for that was yesterday’s hearing; they had to have the data available for that so they might as well pump out the CFATS Fact Sheet.

The table below shows the data for all of the CFATS Fact Sheets published to date.

	April 2013	May 2013	June 2013	July 2013	August 2013
Facilities currently covered by CFATS	4382	4351	4331	4298	4298
Facility Assistance Visits	1202	1242	1253	1264	1276
SSP Authorized	280	380	469	536	589
SSP Approved	53	85	125	166	182

The data shows continued progress is authorizing and approving CFATS site security plans. Looking at the table above is hard to judge rate of approvals, so I have provided the graph below.

 

Both lines appear to be flattening out some, the approvals more so than the authorizations. This is somewhat misleading though as the time periods covered by the data points are not the same. The April and May fact sheets have no ‘effective date’ while the dates for the three latest months are the 6^th, 15^th, and the 1^st respectively. If we normalize that data for the working days in the time period we get the graph below.

 

This shows a dramatic increase in the authorizations and approvals rates in the latest time period. The rate increase may be at least in part due to the movement into the Tier II and Tier III facility reviews. Of course, if this were true we would have expected to see a higher increase in the rate of authorizations vs approvals (a 2.6 factor increase was seen in both) because of the lag effect means that approvals are still being done for Tier I facilities. Another possible explanation could be that ISCD management knew they were going into the hearing yesterday and wanted to pump up the numbers.

I guess only time will tell.